The FBI doesn't need the VPS to be in the United States for that

The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters

FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances.

Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain.

[1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012)

but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets

The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.

I am by far no ransomware expert, but it really seems like amateur hour if they were running a Linux based Bitcoin full node using the mainline CLI daemon and client, with a wallet, on some hosting company geographically within the United States. Why would it need to be in the US?

I only know a few criminal hackers, but within that sample their skillset is really niche. They know what they know well, but otherwise they're just trying to solve problems like any engineer.

Kinda like data scientists - they can be masters with a couple of libraries and concepts, but if you have a data science team you also are more or less guaranteed to have a jupyter notebook open to the world, or something along those lines.

Don't underestimate the stupidity/incompetence of these ransomware devs. Many cybercriminals have been caught for unbelievably dumb reasons.

The connections need to pass through the US just once in order to give the US a chance to attack it.

Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.

> The connections need to pass through the US just once in order to give the US a chance to attack it.

Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.

True, but it would be far less common I reckon.

So many questions. Why are they running a bitcoin node on a vps? do they need to make automated payments or something? it's very easy to run a bitcoin node locally, or even airgap the signing keys.

Really? That seems like something fairly obvious to attempt to prevent from an attacker's viewpoint.

How? A keylogger? Cache somewhere?